I'm just a little suspicious of this story.

Compromising two parties endpoints sounds much more likely than hacking a public and long-lived protocol.

Or its an inside job by someone without access to the hot wallet.